merge: reconcile PR 40 with current lab

Integrate lab fff55a78 into PR #40 (cc25d5ba). Lab's modular email
backend/frontend, modular settings, split stylesheets (static/style.css
stays deleted), procfs compatibility, and request-scoped TurnContract
authority win; PR #40's routing classifiers, editor/email/task features,
and style.css changes are ported into lab's module and stylesheet homes.

Integration fixes:
- settings/api.js imports ui.js under its canonical versioned URL
- browser observations keep legacy CAPTCHA/access-block evidence
- artifact turns do not re-trigger broad-web research recovery
- env reference documents PR test-tool variables; page regenerated

PR #40 defects surfaced by lab gates and fixed here:
- web_fetch generic schema drops top-level anyOf (OpenAI contract);
  the compact preview contract still requires url or urls
- get_weather registered as a brokered network read
- new lazy editor modules precached for offline use
- SearXNG pin mirrored into GPU standalone compose files
- image model picker again skips offline endpoints

Tests updated where PR #40 changed behaviour on purpose, and PR tests
moved onto lab's document_source helpers.

routes/chat_routes.py

@@ -3524,11 +3524,17 @@ def setup_chat_routes(
                     # has an exact routed contract. Adding the whole native
                     # workspace inventory here reintroduced overlapping PDF
                     # readers and caused the model to abandon the selected
-                    # OCR operation. Exact operations therefore stay exact;
-                    # ordinary native turns retain warm and workspace tools.
+                    # OCR operation. A task-only turn likewise has an exact
+                    # personal manager; core shell/Web tools are not task
+                    # fallbacks. Other turns retain warm and workspace tools.
                     extra_tools=(
-                        INTERACTIVE_CORE_TOOLS
-                        if _exact_selected_native_chain
+                        frozenset()
+                        if _exact_selected_native_chain or _active_turn_capabilities == frozenset({"tasks"}) or (
+                            _active_turn_capabilities in (
+                                frozenset({"transcription"}), frozenset({"ocr"}),
+                            )
+                            and not _selected_tools
+                        )
                         else INTERACTIVE_CORE_TOOLS | _warm_tools | (
                             NATIVE_WORKSPACE_TOOLS | (
                                 {"private_browser"} if _local_browser_render_intent else frozenset()